v0.82.14

🌟 Release Highlights

This release focuses on safe-outputs reliability, workshop UX polish, a new top-level model field, and a wave of new linters and security guardrails.

✨ What's New

• Top-level model field — You can now specify the model at the top level of your workflow (e.g., model: claude-sonnet-4-5), deprecating the nested engine.model path. Reference docs
• auto_upgrade_cron in aw.json — Configure a custom auto-upgrade schedule directly in your project manifest instead of relying on defaults.
• Evals enabled across 64 agentic workflows — Broader evaluation coverage improves regression detection and workflow quality assurance.
• --rootless flag for install_copilot_cli.sh — ARC/DinD runners can now install the Copilot CLI without root privileges.
• Mode-specific intent guidance for safe-output tools — Mutation tools now surface targeted guidance based on the current workflow mode, reducing misuse and improving agent decision quality.
• Fail-fast guardrail for schema file changes — The compiler now rejects schema changes that were made without a rebuild, preventing subtle runtime mismatches.
• Workshop: journey/adventure filtering, GFM alerts & task lists — Workshop steps now support filtering by journey/adventure tags, render GitHub-flavored alerts (> [!NOTE]), and display task-list checkboxes.
• Workshop URL hash navigation — Browser back/forward now restores workshop state via URL hash encoding.
• DeepSec & VulnHunter security scan workflows — On-demand and daily security scanning workflows added for continuous vulnerability detection.
• errgroup for structured concurrency in MCP inspector — Replaces ad-hoc goroutine management with proper error propagation.

🐛 Bug Fixes & Improvements

• tools.startup-timeout now propagates to gateway.startupTimeout — Fixes safeoutputs eviction on slow runners where the gateway was timing out before the tool server was ready.
• OTEL_SERVICE_NAME respected — User-defined OpenTelemetry service names are no longer overridden when OTLP observability is enabled.
• MCP CLI prompt list reflects --disable-builtin-mcps — The listed MCP servers now accurately reflect which servers are actually mounted.
• logs tool fixed for missing workflow_name filter — Previously caused a context deadline exceeded error; now handled gracefully.
• safe.directory trust bridged via GIT_CONFIG_* env vars — Fixes git operations in safe-outputs on restrictive runners.
• partial_execution + terminal safe-output treated as success — Prevents false failure signals when an agent completes its final safe-output action after a partial execution state.
• Stable cron schedule in make recompile — Pins --schedule-seed to eliminate drift in auto-upgrade lock files across recompiles.
• #nosec justification separators normalized — - and — variants are now normalised to -- for consistent security annotation parsing.
• close_issue and assign_to_agent payloads — Issue-intent metadata is now correctly nested in the payload structure.
• update_issue MCP body length regression coverage — Added tests to guard against silent truncation above 10 KB.

⚡ Performance

• parseEngineDefinitionFromJSON cached — Eliminates a per-compile JSON→YAML round-trip, reducing compilation overhead for workflows with engine definitions.
• Reduced ambient context token usage — 4 workflows updated to use narrower context windows, lowering AI-credit burn.
• Scheduled workflow staggering — Midnight batch workflows staggered to reduce peak AI-credit consumption.

🔒 Security

• SHA-256 checksum pinned for sentrux binary install — Resolves RGS-018 supply-chain finding.
• no-exec-interpolated-command ESLint rule — Flags shell commands constructed from interpolated strings.
• no-github-request-interpolated-route extended — Now recognises global.getOctokit() aliases.
• Cross-repo regex tightened (SEC-005) — Eliminates false positive on frontmatter_hash_pure.cjs.

🔧 New Linters

• timenowsub — Flags time.Now().Sub(t) patterns that should be time.Since(t).
• trimleftright — Detects distinct-character prefix/suffix bugs from strings.TrimLeft/TrimRight misuse.
• appendoneelement — Catches single-element append patterns that could use assignment.
• no-core-error-then-process-exit (ESLint) — Prevents error-then-exit anti-patterns in GitHub Scripts.
• prefer-core-logging (ESLint) — Enforces structured logging via core.* instead of bare console.*.

📚 Documentation

• ARC/DinD guide expanded — Covers troubleshooting, log paths, and tool cache guidance for rootless runners.
• COPILOT_GITHUB_TOKEN vs GITHUB_TOKEN clarified — New section explains why the tokens are intentionally separate.
• Quick Start: .lock.yml commit intent documented — Clarifies that committing lock files is intentional and expected.
• Workshop relocated to /workshop/ — Canonical URL is now /workshop/ (legacy /workshops/<date-org>/ redirected).

Generated by 🚀 Release · 18.2 AIC · ⊞ 7.9K

---

What's Changed

• Fix workshop progress rail state coupling and responsive overflow by @mnkiefer with @Copilot in #46378
• [instructions] Sync instruction files with release v0.81.6 by @github-actions[bot] in #46403
• [jsweep] Clean checkout_manifest.cjs — add comprehensive tests by @github-actions[bot] in #46340
• [eslint-miner] feat(eslint): add no-core-error-then-process-exit rule by @github-actions[bot] in #46404
• fix(safe-outputs): fall back to env vars when create_report_incomplete_issue omits workflow_name by @pelikhan with @Copilot in #46400
• fix: pin --schedule-seed in make recompile to eliminate cron drift in agentic-auto-upgrade.yml by @pelikhan with @Copilot in #46410
• Enable zen-mode mobile rendering for WorkshopExperience by @pelikhan with @Copilot in #46415
• [docs] Update documentation for features from 2026-07-18 by @github-actions[bot] in #46416
• feat: fail-fast guardrail for schema file changes without rebuild by @pelikhan with @Copilot in #46189
• Document MemoHarness learnings for agentic workflow optimization by @pelikhan with @Copilot in #46417
• enforce mapclearloop in CI linter gates alongside mapdeletecheck by @pelikhan with @Copilot in #46413
• Improve workshop zen mode on mobile by @pelikhan with @Copilot in #46423
• Extend errorfwrapv to flag fmt.Errorf error args without %w by @pelikhan with @Copilot in #46398
• feat(docs): encode workshop state in URL hash for back/forward navigation by @pelikhan with @Copilot in #46405
• Fix visual regression checker access to the docs server by @pelikhan with @Copilot in #46425
• refactor(cli): split long functions in bootstrap_profile_runner to fix largefunc lint by @pelikhan with @Copilot in #46332
• [linter-miner] feat(linters): add appendoneelement linter by @github-actions[bot] in #46289
• Enable detection for Duplicate Code Detector and exempt the upstream AIC audit from local misconfig reporting by @pelikhan with @Copilot in #46420
• Tighten workshop mobile layout spacing and header alignment by @pelikhan with @Copilot in #46427
• [eslint-miner] feat(eslint): add prefer-core-logging rule by @github-actions[bot] in #46195
• feat(mcp-inspect): adopt errgroup for structured concurrency in spawnMCPInspector by @pelikhan with @Copilot in #46409
• Render workshop content through Astro-generated markdown sources by @pelikhan with @Copilot in #46406
• auto-triage: add safe-outputs/copilot component labels, fix partial-triage gap by @pelikhan with @Copilot in #46430
• feat: render GFM alerts in WorkshopExperience by @pelikhan with @Copilot in #46443
• docs: improve ARC/DinD guide with expanded troubleshooting, log paths, and tool cache guidance by @lpcox with @Copilot in #46045
• [docs] Consolidate developer specifications into instructions file (v9.21) by @github-actions[bot] in #46447
• spec: document appendoneelement linter, setutil deps, and remove duplicate test by @pelikhan with @Copilot in #46446
• Restore entry-path card rendering in workshop experience by @pelikhan with @Copilot in #46444
• fix(unbloat-docs): run npm run build instead of npx astro build to include workshop content generation by @pelikhan with @Copilot in #46483
• docs(adr): SPDD gap-fill for ADRs 26385, 26482, 26535, 26544, 26551 by @pelikhan with @Copilot in #46459
• [caveman] Optimize instruction verbosity — charts-trending.md (2026-07-18) by @github-actions[bot] in #46490
• [linter-miner] feat(linters): add trimleftright linter by @github-actions[bot] in #46465
• Switch Daily Skill Optimizer to the Node Copilot SDK driver by @pelikhan with @Copilot in #46428
• fix: stable schedule computation for auto-upgrade workflow by @pelikhan with @Copilot in #46488
• test(actionpins): improve spec_test.go quality per testify-expert checklist by @pelikhan with @Copilot in #46470
• parser: introduce ErrUnsupportedSyntax sentinel; remove all errstringmatch nolints by @pelikhan with @Copilot in #46421
• Reduce scheduled workflow AI-credit burn and stagger the midnight batch by @pelikhan with @Copilot in #46510
• perf: cache parseEngineDefinitionFromJSON to eliminate per-compile JSON→YAML round-trip by @pelikhan with @Copilot in #46469
• [community] Update community contributions in README by @github-actions[bot] in #46512
• feat: render GFM task list syntax (* [ ]) in WorkshopExperience by @pelikhan with @Copilot in #46520
• fix: treat partial_execution + terminal safe-output as success-with-late-activity by @pelikhan with @Copilot in #46493
• [log] Add debug logging to main-job compilation path by @github-actions[bot] in #46522
• chore: bump CLI versions — Claude 2.1.214, Copilot 1.0.71, SDK 1.0.7, Codex 0.144.5, Pi 0.80.10 by @pelikhan with @Copilot in #46407
• doc: sync pkg/linters/doc.go — add trimleftright, update count to 53 by @pelikhan with @Copilot in #46535
• [docs] Update dictation skill instructions by @github-actions[bot] in #46546
• fix(styles): extract helper to clear largefunc lint finding in HuhTheme by @pelikhan with @Copilot in #46523
• fix: pin SHA-256 checksum for sentrux binary install (RGS-018) by @pelikhan with @Copilot in #46555
• docs: clarify that committing .lock.yml is intentional in Quick Start by @pelikhan with @Copilot in #46562
• fix(SEC-005): tighten cross-repo regex to eliminate false positive on frontmatter_hash_pure.cjs by @pelikhan with @Copilot in #46568
• docs: clarify why COPILOT_GITHUB_TOKEN is separate from GITHUB_TOKEN by @pelikhan with @Copilot in #46564
• fix(eslint-factory): exempt console.error/console.warn from prefer-core-logging by @pelikhan with @Copilot in #46552
• fix: pin sub-agent models to claude-haiku-4.5 to resolve daily audit mismatches by @pelikhan with @Copilot in #46551
• feat: add top-level model field, deprecate engine.model by @pelikhan with @Copilot in #46570
• [instructions] Sync instruction files with release v0.82.13 by @github-actions[bot] in #46583
• feat: add auto_upgrade_cron to aw.json for configurable auto-upgrade schedule by @pelikhan with @Copilot in #46521
• trimleftright: widen heuristic to catch distinct-character prefix/suffix bugs by @pelikhan with @Copilot in #46536
• fix(eslint-factory): suppress unsafe autofix for no-core-error-then-process-exit inside helper functions by @pelikhan with @Copilot in #46553
• fix(safe-outputs): bridge git safe.directory trust via GIT_CONFIG_* env vars by @pelikhan with @Copilot in #46057
• Route workshop landing to org-scoped path (/workshop/hackathon-blue-bat-18/) by @mnkiefer with @Copilot in #46579
• test: add unit tests for compiler_custom_jobs.go by @pelikhan with @Copilot in #46587
• feat: filter WorkshopExperience steps by journey/adventure frontmatter by @pelikhan with @Copilot in #46582
• Fix add_labels strict-mode narrowing for CJS lint/typecheck by @pelikhan with @Copilot in #46589
• [eslint-miner] eslint: add no-exec-interpolated-command rule by @github-actions[bot] in #46586
• docs: fix markdown links not rendered inside GFM alert HTML blocks by @pelikhan with @Copilot in #46569
• fix(USE-001): standardize error codes across 4 safe-output handlers by @pelikhan with @Copilot in #46565
• Fix logs tool: context deadline exceeded without workflow_name filter by @pelikhan with @Copilot in #46554
• [rendering-scripts] fix(copilot-parser): strip 'Resume' CLI footer hint from rendered reasoning by @github-actions[bot] in #46581
• [tidy] Format parse_copilot_log.test.cjs with prettier by @github-actions[bot] in #46592
• Make unsafe prefer-core-logging rewrites report-only by @pelikhan with @Copilot in #46588
• Remove legacy /workshop route by @mnkiefer with @Copilot in #46591
• Simplify workshop experience UI to match docs styling by @pelikhan with @Copilot in #46593
• feat(harness): distinguish long-run vs startup Copilot CLI failures via token-count classification by @pelikhan with @Copilot in #46557
• Flatten workshop tutorial chrome and remove nested content boxes by @pelikhan with @Copilot in #46600
• Move workshop from /workshops// to /workshop/ by @mnkiefer with @Copilot in #46616
• Simplify workshop guided run by removing the progress box by @pelikhan with @Copilot in #46598
• [mcp-tools] Sync GitHub MCP toolsets mapping with github-mcp-server main by @github-actions[bot] in #46604
• feat: show step counts on workshop entry path and scenario cards by @pelikhan with @Copilot in #46622
• Finalize SPDD ADRs 26587–26827 and close remaining conformance/doc gaps by @pelikhan with @Copilot in #46628
• Strengthen anomaly detector tests for score normalization and threshold-boundary behavior by @pelikhan with @Copilot in #46636
• [linter-miner] feat(linters): add timenowsub linter — flag time.Now().Sub(t) → time.Since(t) by @github-actions[bot] in #46633
• feat: add --rootless flag to install_copilot_cli.sh for ARC/DinD runners by @lpcox with @Copilot in #46047
• Bump gh-aw-firewall to v0.27.37 and sync AWF integration artifacts by @lpcox in #46637
• [blog] Weekly blog post – 2026-07-20 by @github-actions[bot] in #46698
• feat: reduce ambient context token usage across 4 workflows by @pelikhan with @Copilot in #46684
• [compiler-threat-spec] spec: bump threat detection spec to v1.0.17 (2026-07-20 audit) by @github-actions[bot] in #46701
• Tighten daily blog workflow bash/git permissions to unblock safe PR creation by @pelikhan with @Copilot in #46703
• Model alias inventory update 2026-07-20; fix pr-sous-chef review-thread skip contract by @pelikhan with @Copilot in #46702
• [jsweep] Clean write_daily_aic_usage_cache.cjs by @github-actions[bot] in #46706
• test: model / engine.model resolution and default paths by @pelikhan with @Copilot in #46685
• chore: update drain3 default log pattern weights by @github-actions[bot] in #46716
• [spec-review] Update Safe Outputs conformance checker for spec v1.26.0 by @github-actions[bot] in #46715
• [yamllint-fixer] Reduce yamllint trailing-spaces noise in generated lock files by @github-actions[bot] in #46699
• Use Starlight cards for workshop entry-path selection by @pelikhan with @Copilot in #46722
• Sync pkg/linters docs with registered analyzer set by adding timenowsub by @pelikhan with @Copilot in #46723
• [aw] Eliminate recurring action_required in Content Moderation by removing issue_comment trigger by @pelikhan with @Copilot in #46724
• Workshop: CSS-driven journey-tag visibility for rendered step content by @pelikhan with @Copilot in #46720
• Add daily VulnHunter security scan workflow by @pelikhan with @Copilot in #46742
• Expand timenowsub coverage to safe selector and index arguments by @pelikhan with @Copilot in #46754
• Remove the workshop scenario selection step from the initial tutorial flow by @pelikhan with @Copilot in #46763
• runtime: reject unresolved GitHub Actions expressions in model name by @pelikhan with @Copilot in #46712
• feat: show compressed model name before AIC in all issue/comment footers by @pelikhan with @Copilot in #46764
• fix: constant height for workshop nav and inline buttons by @pelikhan with @Copilot in #46770
• feat: enable evals in 64 agentic workflows by @pelikhan with @Copilot in #46774
• Update AgentRx logs to download agent artifact by @pelikhan with @Copilot in #46772
• Updating selection screen and reusing Astro starlight by @pelikhan with @Copilot in #46782
• [WIP] Fix failing GitHub Actions job 'agent' by @pelikhan with @Copilot in #46766
• Simplify WorkshopExperience HTML and CSS to align with Starlight styles by @pelikhan with @Copilot in #46785
• [instructions] Sync instruction files with release v0.82.13 by @github-actions[bot] in #46784
• fix: respect user-defined OTEL_SERVICE_NAME when OTLP observability is enabled by @pelikhan with @Copilot in #46779
• Add regression coverage for update_issue MCP body length handling above 10KB by @pelikhan with @Copilot in #46781
• Add on-demand DeepSec agentic security scan workflow by @pelikhan with @Copilot in #46792
• Standardize Copilot agent-assignment permission guidance by @pelikhan with @Copilot in #46753
• [eslint-miner] eslint: add require-execsync-try-catch rule by @github-actions[bot] in #46789
• [tidy] Remove unused eslint-disable directive by @github-actions[bot] in #46793
• [docs] Update glossary - weekly full scan by @github-actions[bot] in #46805
• fix: normalize #nosec justification separators from -/— to -- by @pelikhan with @Copilot in #46801
• Disable checkout by default for pull_request_target workflows by @pelikhan with @Copilot in #46771
• Copilot: make MCP CLI prompt list reflect actual mounted servers under --disable-builtin-mcps by @pelikhan with @Copilot in #46778
• chore(deps): update charmbracelet/x/exp/golden to v0.0.0-20260720091843-3eef36eaaa28 by @pelikhan with @Copilot in #46800
• Replace in-doc workshop experience with external workshop repository link by @pelikhan with @Copilot in #46827
• [eslint-factory] core-method-resolve: recognize function-parameter core bindings (DI pattern) by @pelikhan with @Copilot in #46835
• fix: nest issue-intent metadata correctly in close_issue and assign_to_agent payloads by @pelikhan with @Copilot in #46850
• feat(init): make --codespaces optional-value; grant discussions/issues write by @pelikhan with @Copilot in #46849
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in #46860
• feat: mode-specific intent guidance for all safe-output mutation tools by @pelikhan with @Copilot in #46861
• Recognize global.getOctokit() aliases in no-github-request-interpolated-route by @pelikhan with @Copilot in #46856
• [WIP] Fix failing GitHub Actions job for CLI completion by @pelikhan with @Copilot in #46859
• fix: mode-specific intent guidance for all intent-aware safe-output mutations by @pelikhan with @Copilot in #46876
• fix: propagate tools.startup-timeout to gateway.startupTimeout (prevents safeoutputs eviction on slow runners) by @pelikhan with @Copilot in #46875

Full Changelog: v0.82.13...v0.82.14